@martinpu I am facing issues in getting previous week results, any other alternative than this, My code - | bucket _time span=1w
| lookup table_1 LicenseKey OUTPUT CustomerName
| eval CustomerName=coalesce(CustomerName,LicenseKey)
| stats count as Result by CustomerName, ErrorCode
| eventstats sum(Result) as Total by CustomerName
| eval PercentOfTotal = round((Result/Total)*100,3)
| sort - _time
| streamstats current=f latest(Result) as Result_Prev by CustomerName
| eval PercentDifference = round(((Result/Result_Prev)-1)*100,2)
| fillnull value="0"
| append
[ search index=abc= xyz:123 ErrorCode!=0
| `DedupDHI`
| lookup Table_1 LicenseKey OUTPUT CustomerName
| eval CustomerName=coalesce(CustomerName,LicenseKey)
| stats count as Result by CustomerName
| eval ErrorCode="Total", PercentOfTotal=100]
| fillnull value="0"
| lookup Table_2 ErrorCode OUTPUT Description
| lookup Table_1 LicenseKey OUTPUT CustomerName
| eval CustomerName=coalesce(CustomerName,LicenseKey)
| eval Error=if(ErrorCode!="Total", ErrorCode+" ("+coalesce(Description,"Description Missing - Update Table_2")+")", ErrorCode)
| rename Result_Prev as "Previous Week Results", PercentDifference as " Percent Difference", PercentOfTotal as "Percent of Total"
| fields CustomerName, Error, Result,"Previous Week Results", " Percent Difference" , "Percent of Total"
| sort CustomerName, Error, PercentDifference Output - CustomerName Error Result Previous Week Results Percent Difference Percent of Total AIG Private Client Group 1002 (abc) 4 0 0 3.252 AIG Private Client Group 1003 (cxz) 2 4 -50 1.626 AIG Private Client Group 1013 (Invalid Format) 12 4 200 9.756 AIG Private Client Group 1023 (Invalid Name) 3 4 -25 2.439 AIG Private Client Group 1027 (Invalid ) 102 4 2450 82.927 AIG Private Client Group Total 123 0 0 100 AIICO 1023 (Invalid Name) 8 0 0 38.095 AIICO 1201 1 8 -87.5 4.762 AIICO 1305 12 8 50 57.143 AIICO Total 21 0 0 100 Acceptance 1023 (Invalid Name) 3 0 0 27.273 Acceptance 1027 8 3 166.67 72.727 Acceptance Total 11 0 0 100 The Previous Week Results column is appending 4, if noticed which is wrong. any suggestions to solve this ?
... View more